cakephp.1045679.n5.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181935 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Arbitrary File Overwrite

cakephp/cakephp is vulnerable to arbitrary file overwrite. The SmtpTransport module could be used to overwrite arbitrary files on the web server during deserialization of malicious values...

GHSA-QHRX-HCM6-PMRW Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

Unsafe deserialization in SmtpTransport in CakePHP

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

Design/Logic Flaw

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

CVE-2019-11458

CVE-2019-11458 affects CakePHP (SmtpTransport) in version 3.7.6 where an unserialized object with modified internal properties can trigger arbitrary file overwriting on destruction. The root cause is unsafe deserialization in SmtpTransport, enabling file overwrite with webserver write access. The...

CVE-2019-11458

Removed by vendor...

PT-2019-12320 · Cakephp · Cakephp

Name of the Vulnerable Software and Affected Versions: CakePHP version 3.7.6 Description: An issue in SmtpTransport allows an unserialized object with modified internal properties to trigger arbitrary file overwriting upon destruction. Recommendations: For CakePHP version 3.7.6, consider disablin...

CVE-2019-11458: Deserialization of Untrusted Data

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction...

Remote Code Execution (RCE)

cakephp/cakephp is vulnerable to remote code execution RCE attacks. The vulnerability occurs due to unsafe serialization of a socket in SmtpTransport.php in a broken state...

CakePHP 3.7.7, 3.6.15 and 3.5.18 released

CakePHP 3.7.7, 3.6.15 and 3.5.18 released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.7.7, 3.6.15 and 3.5.18. These releases contain a security related fix for CVE-2019-11458. The vulnerability affects applications that open serialized content from user inpu...

Unsafe deserialization in SmtpTransport

More info at https://bakery.cakephp.org/2019/04/23/cakephp37736153518released.html...

CakePHP 3.6.4, 3.5.17, 3.4.14 Released

CakePHP 3.6.4, 3.5.17, 3.4.14 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.6.4. This is a maintenance release for the 3.6 branch that fixes several community reported issues. We are also releasing 3.5.17 and 3.4.14 at this time. These releases contai...

Debian: Security Advisory (DLA-835-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Secure Open Source security review published

Mozilla Secure Open Source security review published Earlier this year we were contacted by Mozilla and notified that our application to the Mozilla Secure Open Source program was accepted and that we would be receiving a review through the SOS program. The SOS program provides security auditing,...

Denial Of Service (DoS)

CakePHP is vulnerable to denial of service DoS attacks. The library does not validate POST data properly, allowing a malicious user to pass large nested POST data to the system, causing a segmentation fault that can crash the system...